diff --git a/source b/source
index 562a173fb96..f352df123ec 100644
--- a/source
+++ b/source
@@ -779,7 +779,6 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
 
 
 
-<!--ADD-TOPIC:Security-->
   <h4>Writing secure applications with HTML</h4>
 
   <!-- NON-NORMATIVE SECTION -->
@@ -899,7 +898,6 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
     attribute).</p>
    </dd>
   </dl>
-<!--REMOVE-TOPIC:Security-->
 
 
   <h4>Common pitfalls to avoid when using the scripting APIs</h4>
@@ -1190,7 +1188,6 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
    </dd>
 
 
-<!--ADD-TOPIC:Security-->
    <dt>Errors that risk exposing authors to security attacks</dt>
 
    <dd>
@@ -1203,7 +1200,6 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
 
     </div>
    </dd>
-<!--REMOVE-TOPIC:Security-->
 
 
    <dt>Cases where the author's intent is unclear</dt>
@@ -4489,7 +4485,6 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
   neutral; leaving them in the DOM (for DOM processors), and styling them according to CSS (for CSS
   processors), but not inferring any meaning from them.</p>
 
-<!--ADD-TOPIC:Security-->
   <p>When support for a feature is disabled (e.g. as an emergency measure to mitigate a security
   problem, or to aid in development, or for performance reasons), user agents must act as if they
   had no support for the feature whatsoever, and as if the feature was not mentioned in this
@@ -4497,7 +4492,6 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
   interface, the attribute itself would be omitted from the objects that implement that interface
   &mdash; leaving the attribute on the object but making it return null or throw an exception is
   insufficient.</p>
-<!--REMOVE-TOPIC:Security-->
 
   </div>
 
@@ -39939,7 +39933,6 @@ dictionary <dfn dictionary>TrackEventInit</dfn> : <span>EventInit</span> {
   </table>
 
 
-<!--ADD-TOPIC:Security-->
   <div w-nodev>
 
   <h5>Security and privacy considerations</h5>
@@ -39981,7 +39974,6 @@ dictionary <dfn dictionary>TrackEventInit</dfn> : <span>EventInit</span> {
   product, then being able to read the subtitles would present a serious confidentiality breach.</p>
 
   </div>
-<!--REMOVE-TOPIC:Security-->
 
 
   <h5>Best practices for authors using media elements</h5>
@@ -59194,7 +59186,6 @@ interface <dfn interface>HTMLDialogElement</dfn> : <span>HTMLElement</span> {
    </dd>
   </dl>
 
-<!--ADD-TOPIC:CSS-->
 
   <div w-nodev>
 
@@ -62025,11 +62016,9 @@ callback <dfn callback>BlobCallback</dfn> = undefined (<span>Blob</span>? blob);
   when invoked, must run these steps:</p>
 
   <ol>
-<!--ADD-TOPIC:Security-->
    <li><p>If this <code>canvas</code> element's bitmap's <span
    data-x="concept-canvas-origin-clean">origin-clean</span> flag is set to false, then throw a
    <span>"<code>SecurityError</code>"</span> <code>DOMException</code>.</p>
-<!--REMOVE-TOPIC:Security-->
 
    <li><p>If this <code>canvas</code> element's bitmap has no pixels (i.e. either its horizontal
    dimension or its vertical dimension is zero) then return the string "<code
@@ -62118,7 +62107,6 @@ callback <dfn callback>BlobCallback</dfn> = undefined (<span>Blob</span>? blob);
 
   </div>
 
-  <!--REMOVE-TOPIC:DOM APIs-->
 
   <h5 id="2dcontext">The 2D rendering context</h5>
 
@@ -62467,12 +62455,10 @@ interface <dfn interface>Path2D</dfn> {
   <p>A <code>CanvasRenderingContext2D</code> object has an <dfn>output bitmap</dfn> that
   is initialized when the object is created.</p>
 
-<!--ADD-TOPIC:Security-->
   <p>The <span>output bitmap</span> has an <span
   data-x="concept-canvas-origin-clean">origin-clean</span> flag, which can be set to true or false.
   Initially, when one of these bitmaps is created, its <span
   data-x="concept-canvas-origin-clean">origin-clean</span> flag must be set to true.</p>
-<!--REMOVE-TOPIC:Security-->
 
   <p>The <code>CanvasRenderingContext2D</code> object also has an <dfn
   data-x="concept-canvas-alpha">alpha</dfn> boolean. When a
@@ -80826,7 +80812,6 @@ dictionary <dfn dictionary>DragEventInit</dfn> : <span>MouseEventInit</span> {
 
 
 
-<!--ADD-TOPIC:Security-->
   <div w-nodev>
 
   <h4>Security risks in the drag-and-drop model</h4>
@@ -80865,7 +80850,6 @@ dictionary <dfn dictionary>DragEventInit</dfn> : <span>MouseEventInit</span> {
   </div>
 
   </div>
-<!--REMOVE-TOPIC:Security-->
 
 
 
@@ -105618,7 +105602,6 @@ function receiver(e) {
   </div>
 
 
-<!--ADD-TOPIC:Security-->
   <h4 id="security-postmsg">Security</h4>
 
   <div w-nodev>
@@ -105675,7 +105658,6 @@ function receiver(e) {
   attacks.</p>
 
   </div>
-<!--REMOVE-TOPIC:Security-->
 
 
 
@@ -106666,8 +106648,6 @@ function showLogout() {
 
 
 
-<!--ADD-TOPIC:Workers-->
-
   <h2 split-filename="workers" id="workers" dfn data-lt="web worker">Web workers</h2>
 
   <h3>Introduction</h3>
@@ -126087,7 +126067,6 @@ interface <dfn interface>External</dfn> {
     8bit (see the section on <span data-x="character encoding declaration">character encoding
     declarations</span>)
    </dd>
-<!--ADD-TOPIC:Security-->
    <dt>Security considerations:</dt>
    <dd>
     <p>Entire novels have been written about the security considerations that apply to HTML
@@ -126119,7 +126098,6 @@ interface <dfn interface>External</dfn> {
     protected from cross-site request forgery attacks by unique tokens, and make use of any
     third-party resources exposed to or rights granted to that origin.</p>
    </dd>
-<!--REMOVE-TOPIC:Security-->
    <dt>Interoperability considerations:</dt>
    <dd>
     Rules for processing both conforming and non-conforming content
@@ -126195,14 +126173,12 @@ interface <dfn interface>External</dfn> {
    <dd>No optional parameters.</dd>
    <dt>Encoding considerations:</dt>
    <dd>binary</dd>
-<!--ADD-TOPIC:Security-->
    <dt>Security considerations:</dt>
    <dd>
     Subresources of a <code>multipart/x-mixed-replace</code>
     resource can be of any type, including types with non-trivial
     security implications such as <code>text/html</code>.
    </dd>
-<!--REMOVE-TOPIC:Security-->
    <dt>Interoperability considerations:</dt>
    <dd>
     None.
@@ -126270,10 +126246,8 @@ interface <dfn interface>External</dfn> {
    <dd>Same as for <code>application/xml</code> <ref spec=RFC7303></dd>
    <dt>Encoding considerations:</dt>
    <dd>Same as for <code>application/xml</code> <ref spec=RFC7303></dd>
-<!--ADD-TOPIC:Security-->
    <dt>Security considerations:</dt>
    <dd>Same as for <code>application/xml</code> <ref spec=RFC7303></dd>
-<!--REMOVE-TOPIC:Security-->
    <dt>Interoperability considerations:</dt>
    <dd>Same as for <code>application/xml</code> <ref spec=RFC7303></dd>
    <dt id="authors-using-xhtml">Published specification:</dt>
@@ -126343,14 +126317,12 @@ interface <dfn interface>External</dfn> {
    </dd>
    <dt>Encoding considerations:</dt>
    <dd>Not applicable.</dd>
-<!--ADD-TOPIC:Security-->
    <dt>Security considerations:</dt>
    <dd>
     <p>If used exclusively in the fashion described in the context of
     <span>hyperlink auditing</span>, this type introduces no new
     security concerns.</p>
    </dd>
-<!--REMOVE-TOPIC:Security-->
    <dt>Interoperability considerations:</dt>
    <dd>
     Rules applicable to this type are defined in this specification.
@@ -126414,10 +126386,8 @@ interface <dfn interface>External</dfn> {
    <dd>Same as for <code>application/json</code> <ref spec=JSON></dd>
    <dt>Encoding considerations:</dt>
    <dd>8bit (always UTF-8)</dd>
-<!--ADD-TOPIC:Security-->
    <dt>Security considerations:</dt>
    <dd>Same as for <code>application/json</code> <ref spec=JSON></dd>
-<!--REMOVE-TOPIC:Security-->
    <dt>Interoperability considerations:</dt>
    <dd>Same as for <code>application/json</code> <ref spec=JSON></dd>
    <dt>Published specification:</dt>
@@ -126496,7 +126466,6 @@ interface <dfn interface>External</dfn> {
    </dd>
    <dt>Encoding considerations:</dt>
    <dd>8bit (always UTF-8)</dd>
-<!--ADD-TOPIC:Security-->
    <dt>Security considerations:</dt>
    <dd>
     <p>An event stream from an origin distinct from the origin of the content consuming the event
@@ -126511,7 +126480,6 @@ interface <dfn interface>External</dfn> {
     reconnect rapidly. Servers should use a 5xx status code to indicate capacity problems, as this
     will prevent conforming clients from reconnecting automatically.</p>
    </dd>
-<!--REMOVE-TOPIC:Security-->
    <dt>Interoperability considerations:</dt>
    <dd>
     Rules for processing both conforming and non-conforming content are defined in this